# Teams, members & roles

Every Koo account is a shared workspace. A member is a user with a role in the account, and every action — viewing logs, deploying, changing billing — is gated by that role.

You manage members on your account's **Members** page. The same operations are available through the [accounts API](/api/accounts); each entry is a [member object](/api/objects/member).

## Roles

Each member holds exactly one of four roles. Roles are cumulative: every role can do everything the roles below it can. The API uses the names in the first column; the console labels them **Viewer**, **Developer**, **Admin**, and **Owner**.

> **Note:**
>
> An account always has exactly one owner. You can't demote or remove the current owner directly — transfer ownership to another member first, then change or remove the old owner like any other member.

## Manage members

Any member can see the member list. Changing roles and removing members requires the owner role.

### Change a role

Pick the new role on the member's row. The change takes effect on the member's next request — there is no re-invite or re-login step.

### Transfer ownership

To hand over the account, assign the `owner` role to another member. The transfer is atomic: that member becomes the owner and the previous owner becomes an `admin` in the same operation, so the account never has zero or two owners.

### Remove a member

Removing a member revokes their access to the account immediately. It doesn't delete their Koo user or their other memberships — they just lose access to this one.

## Invite a member

Joining works by link, never by direct add — becoming a member always takes the invitee's consent. Creating invites requires the owner role.

1. 
2. 
3. 
4. 
5.

Each link admits a single member, then it's spent. A link also expires on its own after seven days, and you can revoke a pending one from the Members page at any time. There is no resend: a dead link — used, revoked, or expired — is replaced by creating a new one.

Accepting is refused when the account has no seats left. The invite stays valid: once the owner has added seats or upgraded, the same link works.

## Seats & plans

On the Free plan the account is fixed at one member — you can't invite anyone. Paid plans include a number of seats, and members beyond the included count add a per-seat charge to your subscription. See [billing](/docs/account/billing) for the seat counts and per-seat prices on each plan.

## Service accounts

A service account is a non-human principal for CI and automation. It belongs to one account and holds a role of its own — **Read** (the `reader` role) or **Write** (the `editor` role), never `owner` — so it can act, but never touch members, plans, or billing.

Service accounts don't sign in: each one authenticates with a `kc_…` token, created on your account's **Tokens** page. See [API tokens](/docs/developers/api-tokens) for creating and revoking them.